Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
74
Malware
PetitPotam
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 30, 2026
- Last mentioned7h ago
Timeline
2 articles · newest firstTeams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
73
Appears with
- Active Directory Certificate Servicesproduct · 2
- Microsoftvendor · 2
- Microsoft Teamsproduct · 2
- Quick Assistproduct · 2
- Rclonemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.